Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discord fined €800k for failing to comply with several obligations of the GDPR

cnil.fr

Post reply on HN
Print view View original

171–180 of 306 posts

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#171

Post by nabla9 »

namdnay wrote: post #154
theCrowing wrote: post #89

Sorry but the points are totally valid. If you delete your account your messages are still available with a userid that if someone has it can be traced back to you. They also don't delete files or pictures you uploaded alone for this they should get fined.

isn't that the case for gmail? if you send me an email with a picture in it, then delete your email account, i can still see your email when logging into my gmail

No. Email is private messaging.

If you send email to me and then delete it in your end, I'm allowed to store your email as a whole (sometimes legally obliged).

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#172

Post by falcor84 »

Spivak wrote: post #139
lzooz wrote: post #127

Earlier quoted context omitted.

I agree with you in principle and I think that the EU is basically extorting American companies, but in your example all that information is stored in your phone, while in this case the information is stored in Discord's servers.

Right which to me is a distinction without a difference. If you and me are both Gmail users and you send me an email then delete your account should Gmail have to reach into my inbox and delete your emails? They’re on Google’s servers after all.

There's a spectrum of things I can share with you over gmail. Currently, if I share an email with some formatted text and attachments up to 25MB, then it's yours to keep, but anything above 25MB is shared as a link to a Google Drive upload, which remains under my account, and I can always delete or modify.

But I don't see any particular reason for where exactly the line between the two should be - why wouldn't it be that I could make anything I shared with you ephemeral, a-la Snapchat? And going back to email, it was actually MS Exchange who have supported the option to "Recall this message" [0] for many years, while gmail decided to not implement anything like that.

[0] https://support.microsoft.com/en-us/office/recall-or-replace...

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#173

Post by nikvaes »

bjt2n3904 wrote: post #133

Some questions I need answered, that have yet to be answered in the article, or the comments here: Does Discord have an officially established business presence in the EU? That is, do they have an office? Employees? Remote workers officially living in the EU? A business license of some sort? One of the large questions here, entirely separate from the validity of the technical issues is of jurisdiction, and the answer…

Yes, they have registered a company in The Netherlands:

https://support.discord.com/hc/en-us/articles/4410339409047-...

https://www.kvk.nl/orderstraat/product-kiezen/?kvknummer=822...

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#174

Post by debugnik »

FamosoRandom wrote: post #60
origin_path wrote: post #26

Does Discord even have a corporate presence in the EU? For the French government to be fining companies because they happen to dislike the UI is such a random and unpredictable decision that it seems like a strong signal for US firms to not set up offices in the EU at all.

it's not so simple as "disliking the UI", it's about the UI/UX being clear enough that the user understand what he is doing in order to not be harmed by it in any way (disclosing personnal information for instance). Simply imagine that the user thought that, by clicking the "X" button, he closed the app and got off the vocal channel so that now nobody can hear him. Now a close relative ask him some other personnal in…

> Simply imagine that the user thought that, by clicking the "X" button, he closed the app

Do most users think that, though? I remember chat apps minimising to the tray bar since MSN Messenger and Skype, possibly earlier, and it's a common feature in most current ones, as well as in other applications.

Now, it's true that some other chat apps display a floating panel to remind you that you're still in voice chat, but Discord's target audience is videogame players that don't want their media covered by such panel anyway, and most other chat apps let you close or disable such panel as well. Game consoles don't do so either.

I agree with the other points in the case, but this UX design being a GDPR issue makes it clear these people are out of touch with the market.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#175

Post by radicalbyte »

theCrowing wrote: post #89

Sorry but the points are totally valid. If you delete your account your messages are still available with a userid that if someone has it can be traced back to you. They also don't delete files or pictures you uploaded alone for this they should get fined.

How does this work for IRC networks?

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#176

Post by daveoc64 »

bjt2n3904 wrote: post #133

Some questions I need answered, that have yet to be answered in the article, or the comments here: Does Discord have an officially established business presence in the EU? That is, do they have an office? Employees? Remote workers officially living in the EU? A business license of some sort? One of the large questions here, entirely separate from the validity of the technical issues is of jurisdiction, and the answer…

Why do you need the answer to this?

If your follow up question will be "how can the EU do anything against a company that operates outside of its jurisdiction?", then the answer will be "by making it difficult for people in the EU to do business with Discord".

The EU could restrict payments to Discord for example, cutting their revenue.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#177

Post by simion314 »

ahungry wrote: post #132
matkoniecz wrote: post #118

Earlier quoted context omitted.

> that's enough for a GDPR violation I guess? No, you would also need to run on computers of people not understanding what is going on. In the same way as running > rm -rf /* on computers of people not understanding what is going on (or not agreeing to it) and where you are not allowed to do so is illegal, for quite good reasons.

Did the users choose to install the Discord app (or run a random command?) How are you supposed to confirm "user understanding"? Does the program need to require a tutorial/training before it's being used? A user's ignorance shouldn't be a software distributor's problem. If the discord app didn't have a system tray, and hid it's process from the Process List someway, maybe you have a point - this is just ignorance ac…

I think if you are doing the close is actually not killing the app you should ensure the user is aware the app is still recording. Some apps will show a recoding thinggy ont he screen or it will tell you before closing and you need to agree.

I don't have the time to test this, but if is true that you close the app and it sill continue recording that this is bad UX and the company should have prioritize fixing this instead of adding even more crap. Maybe some good practices would come from this.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#178

Post by blibble »

akuji1993 wrote: post #144
dandellion wrote: post #86

Earlier quoted context omitted.

Probably nothing happens. I doubt they're going to spend time investigating a company that doesn't do any business in Europe, when there's a very long list of bigger companies that do operate here and break our privacy and sell our data.

If the company doesn't do any business in Europe it has no users in Europe, therefore it doesn't have to comply with the GDRP at all.

GDPR is extra-territorial and its rights apply to EU citizens wherever they are in the world

if a EU user is in the US ON HOLIDAY! and they're using your service, you're subject to the GDPR

(in theory)

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#179

Post by bjt2n3904 »

nikvaes wrote: post #173
bjt2n3904 wrote: post #133

Some questions I need answered, that have yet to be answered in the article, or the comments here: Does Discord have an officially established business presence in the EU? That is, do they have an office? Employees? Remote workers officially living in the EU? A business license of some sort? One of the large questions here, entirely separate from the validity of the technical issues is of jurisdiction, and the answer…

Yes, they have registered a company in The Netherlands: https://support.discord.com/hc/en-us/articles/4410339409047-... https://www.kvk.nl/orderstraat/product-kiezen/?kvknummer=822...

Excellent, thank you!

This entirely renders the question of jurisdiction moot.

It's frustrating that the response to this question has been so negative. It's like even asking this question is forbidden.

Re: Discord fined €800k for failing to comply with several obligations of the GDPR

#180

Post by bathtub365 »

radicalbyte wrote: post #175
theCrowing wrote: post #89

Sorry but the points are totally valid. If you delete your account your messages are still available with a userid that if someone has it can be traced back to you. They also don't delete files or pictures you uploaded alone for this they should get fined.

How does this work for IRC networks?

IRC networks don’t generally store messages and your client only receives messages that are sent while connected to the network. Users can set up their own infrastructure to store messages received by their client, though, so you never know who might be collecting logs.
Post reply on HN